I Will set up PostgreSQL row-level security so each user sees only their own data, Supabase included

Any app with user accounts, paid plans or several teams in one database has to decide who may see which rows. If that rule lives only in the app code, it fails the first time someone reaches the data another way: a new endpoint someone forgot to guard, a second app on the same database, or the API that Supabase generates for your tables. Row-level security puts the rule where the data is.

I have done this on a subscription product under NDA: row-level security policies on the tables and a separate database role for each subscription tier, so what a plan includes is enforced by PostgreSQL, not by a check someone might forget.

In Starter, I review the policies that up to five tables have or lack and send a written list of gaps, with an example query that shows each one. Standard writes or fixes policies on up to ten tables, sets up the roles your app needs, delivers them as migration files, and adds tests in which user A tries to read and change user B's rows and fails. Advanced covers up to twenty-five tables, adds plan or tier limits enforced in the database, and runs the tests in CI.

On Supabase, the same PostgreSQL features apply, with auth.uid() and the JWT claims used inside policies. On plain PostgreSQL, policies read the current user from a session setting that your backend sets for each request.

No calls. Every package ends with a plain-language note on who can see what; on Standard and Advanced, the policies also arrive as migrations in your repository, together with the tests. For 14 days after delivery, I fix anything that does not work as we agreed, free of charge.

Steps for completing your project
1. Map the data - I list the tables, who owns each row, and who should read or change it: owners, team members, admins, each plan.
2. Review what exists - Current policies, grants and roles are checked against that map, and every gap is written down with a query that shows it.
3. Policies and roles - Policies are written per table and per action, with roles for plans or teams, as migration files you can review.
4. Prove it - Tests log in as different users and try to read and change each other's data. Every forbidden action has to fail, and every allowed one has to work.
5. Handover - A short note in plain words on who can see what, the migrations, and how to add a policy when a new table appears.